From d3dbf2bf9cfb64f0d188627acba09a4e859d1ee3 Mon Sep 17 00:00:00 2001
From: alex <alex@local>
Date: Sun, 24 May 2026 17:45:23 +0200
Subject: [PATCH] fix: disable auto-login by default, require explicit
 auto_login=1

Auto-launch of D2R and bnet credential injection are now gated behind
an explicit `auto_login=0` flag in params.ini. Setting it to 1 restores
the previous behaviour. Credentials stored in bnet_name/bnet_pass are
never appended to launch options while auto_login=0.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 config/params.ini |  5 +++--
 src/config.py     | 10 ++++++----
 src/main.py       |  8 +++-----
 3 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/config/params.ini b/config/params.ini
index d4662b4..b8c0c38 100644
--- a/config/params.ini
+++ b/config/params.ini
@@ -7,8 +7,9 @@ target_tz=1
 saved_games_folder=
 level_max_steps=20
 
-; Battle.net credentials (for auto-login at launch)
-; Leave empty to log in manually
+; Set to 1 to enable auto-login and auto-launch of D2R on startup.
+; Credentials below are ONLY used when auto_login=1.
+auto_login=0
 bnet_name=
 bnet_pass=
 
diff --git a/src/config.py b/src/config.py
index 2b7cada..c532403 100644
--- a/src/config.py
+++ b/src/config.py
@@ -149,6 +149,7 @@ class Config:
             "d2r_path": _default_iff(self._select_val("general", "d2r_path"), "", r"C:\Program Files (x86)\Diablo II Resurrected"),
             "restart_d2r_when_stuck": bool(int(self._select_val("general", "restart_d2r_when_stuck"))),
             "hardcore": bool(int(self._select_val("general", "hardcore"))),
+            "auto_login": bool(int(self._select_val("general", "auto_login"))),
             "bnet_name": self._select_val("general", "bnet_name"),
             "bnet_pass": self._select_val("general", "bnet_pass"),
             "char_name": self._select_val("general", "char_name"),
@@ -424,10 +425,11 @@ class Config:
         opts = self._select_val("advanced_options", "launch_options").replace(
             "<name>", only_lowercase_letters(self.general["name"].lower())
         )
-        bnet_name = self.general.get("bnet_name", "")
-        bnet_pass = self.general.get("bnet_pass", "")
-        if bnet_name and bnet_pass:
-            opts += f" -bnetname {bnet_name} -bnetpass {bnet_pass}"
+        if self.general.get("auto_login", False):
+            bnet_name = self.general.get("bnet_name", "")
+            bnet_pass = self.general.get("bnet_pass", "")
+            if bnet_name and bnet_pass:
+                opts += f" -bnetname {bnet_name} -bnetpass {bnet_pass}"
         return opts
 
 if __name__ == "__main__":
diff --git a/src/main.py b/src/main.py
index 504bbf7..2deba50 100644
--- a/src/main.py
+++ b/src/main.py
@@ -88,16 +88,14 @@ def main():
         print(f"ERROR: Unkown logg_lvl {Config().advanced_options['logg_lvl']}. Must be one of [info, debug]")
     startup_checks()
 
-    # Auto-launch D2R if not already running
+    # Auto-launch D2R only when explicitly enabled in params.ini (auto_login=1)
     from utils.restart import process_exists, restart_game
     if not process_exists("D2R.exe"):
-        if Config().general.get("bnet_name", "") and Config().general.get("bnet_pass", ""):
+        if Config().general["auto_login"]:
             Logger.info("D2R is not running, launching with auto-login...")
             restart_game(Config().general["d2r_path"], Config().advanced_options["launch_options"])
         else:
-            Logger.info("D2R is not running. No auto-login configured - please launch D2R and log in, then press the resume key to start.")
-            # Don't auto-launch without credentials; user will start manually
-            # Still show the UI and wait for resume key
+            Logger.info("D2R is not running and auto_login=0 — please launch D2R manually, then press the resume key to start.")
     else:
         Logger.info("D2R is already running")